Is js-yaml 3.1 vulnerable?

npm · 1 release from 3.1.0 to 3.1.0 · latest js-yaml is 5.5.0 · checked 2 Nov 2026

Yes: 7 known advisories

Yes. js-yaml 3.1.0, the last 3.1 release, is affected by 7 known security advisories (4 high, 3 medium), including CVE-2026-84375, CVE-2026-59869, CVE-2026-53550. Upgrade to 3.15.2 or later to fix all of them.

Upgrade with:npm install js-yaml@3.15.2

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting js-yaml 3.1.0

  • HighCVE-2026-84375GHSA-2883-xcg3-v3hh8 Sept 2026

    js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

    Affected
    >=4.0.0 <4.3.2 · >=3.0.0 <3.15.2
    Fixed in
    3.15.2, 4.3.2
  • HighGHSA-5p4m-2wfm-xmqj6 Aug 2026

    JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

    Affected
    >=4.0.0 <4.3.1 · >=3.0.0 <3.15.1
    Fixed in
    3.15.1, 4.3.1
  • HighCVE-2026-59869GHSA-52cp-r559-cp3m20 Jul 2026

    js-yaml: YAML merge-key chains can force quadratic CPU consumption

    Affected
    >=3.0.0 <3.15.0 · >=4.0.0 <4.3.0
    Fixed in
    3.15.0, 4.3.0
  • MediumCVE-2026-53550GHSA-h67p-54hq-rp6815 Jun 2026

    JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

    Affected
    >=4.0.0 <4.2.0 · <3.15.0
    Fixed in
    3.15.0, 4.2.0
  • MediumCVE-2025-64718GHSA-mh29-5h37-fv8m14 Nov 2025

    js-yaml has prototype pollution in merge (<<)

    Affected
    >=4.0.0 <4.1.1 · <3.14.2
    Fixed in
    3.14.2, 4.1.1
  • MediumGHSA-2pr6-76vf-75465 Jun 2019

    Denial of Service in js-yaml

    Affected
    <3.13.0
    Fixed in
    3.13.0
  • HighGHSA-8j8c-7jfh-h6hx4 Jun 2019

    Code Injection in js-yaml

    Affected
    <3.13.1
    Fixed in
    3.13.1

Which of your client projects are still on js-yaml 3.1?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact js-yaml version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other js-yaml versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.